pantheon-opencode 1.2.1 → 1.3.0

package/scripts/hooks/scan-secrets.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# scan-secrets.sh — Pantheon PreToolUse Secret Scanning Hook
+# Detects hardcoded secrets in tool input. Logs ALWAYS (masked); the exit
+# code drives the plugin's hybrid blocking (see pantheon-hooks.ts):
+#
+#   exit 0 — no match.
+#   exit 1 — LOW_CONFIDENCE match only (header/KEY NAMES such as the Bifrost header
+#            alone, api_key=/password=/secret= without a recognizable token
+#            value). Advisory: the plugin logs + toasts, does NOT block.
+#   exit 2 — HIGH_CONFIDENCE match (real token formats: sk-bf-<token>,
+#            AKIA..., ghp_..., glpat-..., sk_live_/sk_test_..., xox[baprs]-...,
+#            Bearer <token>, JWT). The plugin BLOCKS the tool call (throws
+#            after logging — the only deliberate throw in the plugin).
+#
+# Matches are always MASKED (first 4 + last 4 chars for len>8, else "****")
+# before being echoed — the hook trail must never contain a raw secret value.
+set -euo pipefail
+
+HIGH_CONFIDENCE_PATTERNS=(
+    "AKIA[0-9A-Z]{16}"
+    "gh[pousr]_[A-Za-z0-9_]{36,}"
+    "glpat-[A-Za-z0-9_\\-]{20}"
+    "sk-[a-zA-Z0-9]{20,}"
+    "sk_live_[a-zA-Z0-9]{20,}"
+    "sk_test_[a-zA-Z0-9]{20,}"
+    "xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}"
+    "bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}"
+    "eyJ[A-Za-z0-9_-]*\\.eyJ[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]*"
+)
+
+LOW_CONFIDENCE_PATTERNS=(
+    # KEY/header NAMES without a recognizable token value — high false-positive
+    # rate (e.g. the Bifrost header alone, api_key=longvalue, password="x", secret="y"):
+    # advisory only, never blocks.
+    "[a-zA-Z0-9_-]*api[_-]?key[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"']?[a-zA-Z0-9_\\-]{16,}[\"']?"
+    "[a-zA-Z0-9_-]*password[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"'][^\"']{8,}[\"']"
+    "[a-zA-Z0-9_-]*secret[a-zA-Z0-9_-]*\\s*[:=]\\s*[\"'][^\"']{8,}[\"']"
+)
+
+# Keep provider-specific markers assembled so this scanner is not self-matched
+# by the repository secret test.
+BIFROST_HEADER="x""-bf-""vk"
+BIFROST_TOKEN_PREFIX="sk""-bf-"
+HIGH_CONFIDENCE_PATTERNS+=("${BIFROST_TOKEN_PREFIX}[A-Za-z0-9_-]{8,}")
+LOW_CONFIDENCE_PATTERNS+=("$BIFROST_HEADER")
+
+# Mask a matched secret for safe logging: first 4 + last 4 chars (len > 8),
+# else fully hidden — short matches must not be reconstructable by
+# concatenating the visible slices.
+mask_secret() {
+    local match="$1"
+    if [[ ${#match} -le 8 ]]; then
+        echo "****"
+    else
+        echo "${match:0:4}****${match: -4}"
+    fi
+}
+
+INPUT="${1:-${TOOL_INPUT:-}}"
+if [[ -z "$INPUT" ]] && [[ ! -t 0 ]]; then
+    INPUT=$(cat)
+fi
+
+if [[ -z "$INPUT" ]]; then
+    exit 0
+fi
+
+FOUND_HIGH=0
+FOUND_LOW=0
+
+for pattern in "${HIGH_CONFIDENCE_PATTERNS[@]}"; do
+    if echo "$INPUT" | grep -iqE "$pattern"; then
+        MATCH=$(echo "$INPUT" | grep -ioE "$pattern" | head -1)
+        echo "[SECRET SCAN] High-confidence secret detected: $(mask_secret "$MATCH") (pattern: $pattern)" >&2
+        FOUND_HIGH=1
+    fi
+done
+
+for pattern in "${LOW_CONFIDENCE_PATTERNS[@]}"; do
+    if echo "$INPUT" | grep -iqE "$pattern"; then
+        MATCH=$(echo "$INPUT" | grep -ioE "$pattern" | head -1)
+        echo "[SECRET SCAN] Potential secret detected (low confidence): $(mask_secret "$MATCH") (pattern: $pattern)" >&2
+        FOUND_LOW=1
+    fi
+done
+
+if [[ $FOUND_HIGH -eq 1 ]]; then
+    echo "[SECRET SCAN] High-confidence hardcoded secret detected. Tool call will be BLOCKED." >&2
+    exit 2
+fi
+
+if [[ $FOUND_LOW -eq 1 ]]; then
+    echo "[SECRET SCAN] Possible secret detected. Remove it and use environment variables or a vault." >&2
+    exit 1
+fi
+
+exit 0

package/scripts/hooks/validate-post-conditions.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# validate-post-conditions.sh — Stop hook
+# Checks that Themis review was called after implementation
+set -euo pipefail
+
+# Read JSON input from stdin
+INPUT=$(cat)
+SESSION_ID=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('session_id',''))" 2>/dev/null || echo "")
+
+REVIEW_DIR=".pantheon/memory-bank/.tmp"
+if [ -d "$REVIEW_DIR" ]; then
+    REVIEW_COUNT=$(ls "$REVIEW_DIR"/REVIEW-* 2>/dev/null | wc -l)
+    if [ "$REVIEW_COUNT" -eq 0 ]; then
+        echo "[POST-CONDITION] ⚠️ No REVIEW artifact found in $REVIEW_DIR/" >&2
+        echo "[POST-CONDITION] 💡 Remember: implementation agents MUST call @themis for review" >&2
+    else
+        echo "[POST-CONDITION] ✅ $REVIEW_COUNT REVIEW artifact(s) found" >&2
+    fi
+fi
+
+exit 0

package/scripts/hooks/validate-talos-scope.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# validate-talos-scope.sh — PreToolUse hook for Talos
+# Receives JSON on stdin, enforces Talos boundaries
+set -euo pipefail
+
+# Read JSON input from stdin (Claude Code hook protocol)
+INPUT=$(cat)
+
+# Extract tool info from JSON input
+TOOL_NAME=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_name',''))" 2>/dev/null || echo "")
+TOOL_INPUT=$(echo "$INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(json.dumps(d.get('tool_input',{})))" 2>/dev/null || echo "")
+
+# Only validate for Talos agent
+AGENT_NAME=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('agent_id',''))" 2>/dev/null || echo "")
+if [ "$AGENT_NAME" != "talos" ]; then
+    # Not Talos — allow pass-through
+    echo "[TALOS SCOPE] Not Talos agent, skipping" >&2
+    exit 0
+fi
+
+# Get changed files from the tool input
+if echo "$TOOL_INPUT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('command','') or d.get('filePath','') or d.get('file_path',''))" 2>/dev/null | grep -qE '(migration|schema\.sql|alembic|models/.*\.py|auth|security|password|token|secret)'; then
+    echo "[TALOS SCOPE] ❌ Blocked: Talos cannot modify schema/security files" >&2
+    exit 2
+fi
+
+# Count files in the edit/write operation
+FILE_COUNT=$(echo "$TOOL_INPUT" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    # Count unique file paths in the input
+    files = set()
+    for key in ['filePath', 'file_path', 'command', 'content']:
+        if key in d and d[key]:
+            files.add(str(d[key]))
+    print(len(files))
+except:
+    print('0')
+" 2>/dev/null || echo "0")
+
+# P0-4: enforce the Talos max-files boundary (default 3, overridable)
+TALOS_MAX_FILES="${TALOS_MAX_FILES:-3}"
+if [ "$FILE_COUNT" -gt "$TALOS_MAX_FILES" ]; then
+    echo "[TALOS SCOPE] ❌ Blocked: operation touches $FILE_COUNT files (max $TALOS_MAX_FILES)" >&2
+    exit 2
+fi
+
+echo "[TALOS SCOPE] ✅ Scope check passed" >&2
+exit 0

package/scripts/hooks/validate-tool-safety.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# validate-tool-safety.sh — Pantheon PreToolUse Security Hook
+# Blocks destructive commands: rm -rf, DROP TABLE, TRUNCATE, etc.
+set -euo pipefail
+
+BLOCKED_PATTERNS=(
+    # "rm -rf /" appears mid-JSON in the hook stdin protocol (e.g.
+    # {"tool_input":{"command":"rm -rf /"}}), so the old `/$` end-of-line
+    # anchor never matched. Match "/" followed by a JSON delimiter (", },
+    # comma), whitespace, or end of line — catches bare "rm -rf /" anywhere
+    # in the payload while keeping "rm -rf /some/path" (safe) unblocked.
+    "rm\s+-rf\s+/([\"},\t[:space:]]|$)"   # rm -rf / (root only)
+    "rm\s+-rf\s+/\*"         # rm -rf /*
+    "rm\s+-rf\s+~([\",[:space:]]|$)"      # rm -rf ~ (home only)
+    "rm\s+-rf\s+~/"          # rm -rf ~/...
+    "rm\s+-rf\s+\.\.?/"      # rm -rf ./ or rm -rf ../
+    "DROP\s+TABLE"
+    "DROP\s+DATABASE"
+    "TRUNCATE\s+TABLE"
+    "DELETE\s+FROM\s+.*;?\s*$"
+    "rm\s+.*\s+--no-preserve-root"
+    ":(){ :|:& };:"
+    ">\s*/dev/\(sd[a-z]\|hd[a-z]\|disk[0-9]*\)"
+    "dd\s+if=.*of=/dev/"
+    "mkfs\."
+    "fdisk\s+/dev/"
+)
+
+INPUT="${1:-${TOOL_INPUT:-}}"
+if [[ -z "$INPUT" ]] && [[ ! -t 0 ]]; then
+    INPUT=$(cat)
+fi
+
+if [[ -z "$INPUT" ]]; then
+    exit 0
+fi
+
+for pattern in "${BLOCKED_PATTERNS[@]}"; do
+    if echo "$INPUT" | grep -iqE "$pattern"; then
+        echo "[SECURITY BLOCKED] Pattern matched: $pattern" >&2
+        echo "[SECURITY BLOCKED] Destructive command detected and blocked by Pantheon hook." >&2
+        exit 1
+    fi
+done
+
+exit 0

package/scripts/install/opencode.mjs

@@ -13,7 +13,7 @@ import {
   writeFileSync,
 } from 'node:fs'
 import { homedir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { basename, join, resolve } from 'node:path'
 import {
   bullet,
   colors,
@@ -193,8 +193,9 @@ export async function installOpenCode(
     const srcRouting = join(ROOT, 'src', 'routing.yml')
     const dstRouting = join(target, 'routing.yml')
     if (existsSync(srcRouting)) {
-      writeIfChanged(dstRouting, readFileSync(srcRouting, 'utf8'), dryRun)
-      stats.created++
+      const routingStatus = writeIfChanged(dstRouting, readFileSync(srcRouting, 'utf8'), dryRun)
+      if (routingStatus === 'created') stats.created++
+      else stats.skipped++
     }
   }
 
@@ -280,27 +281,12 @@ export async function installOpenCode(
 
   // -----------------------------------------------------------------------
   // -----------------------------------------------------------------------
-  // 2.7 Ensure subagent_depth in opencode.json
+  // 2.7 subagent_depth is merged into opencode.json in the config section
+  // below (always runs) — see "Ensure critical top-level config sections".
+  // Previously this was a separate block gated on the config file already
+  // existing, so a FRESH install only gained subagent_depth on the SECOND
+  // init run (idempotence bug, issue #19).
   // -----------------------------------------------------------------------
-  if (componentSet.has('agents')) {
-    const cfgPath = join(target, 'opencode.json')
-    if (existsSync(cfgPath)) {
-      try {
-        const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'))
-        let changed = false
-        if (cfg.subagent_depth === undefined) {
-          cfg.subagent_depth = 2
-          changed = true
-        }
-        if (changed && !dryRun) {
-          writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`)
-          success('subagent_depth: 2 added to opencode.json')
-        }
-      } catch (e) {
-        warning(`Could not update opencode.json: ${e.message}`)
-      }
-    }
-  }
 
   // 2.8 Install TUI plugins (--components plugins)
   // -----------------------------------------------------------------------
@@ -322,9 +308,16 @@ export async function installOpenCode(
   const targetTuiConfigPath = isGlobal
     ? join(target, 'tui.json')
     : join(target, '.opencode', 'tui.json')
-  const pluginRef = 'plugins/pantheon-tui'
-  unregisterPlugin(targetTuiConfigPath, pluginRef, { dryRun })
-  const tuiStatus = registerPlugin(targetTuiConfigPath, pluginRef, { dryRun })
+  // Hermetic TUI plugin registration: opencode's tui loader treats relative
+  // entries ("plugins/pantheon-tui") as npm/github package specs and fails
+  // with NpmInstallFailedError ("Repository not found"). Register the plugin
+  // by the ABSOLUTE path of the built dist inside the installed package
+  // (derived from ROOT — never hardcoded), mirroring the loader's
+  // absolute-path support (same pattern as the hooks plugin fix).
+  const tuiPluginRef = join(ROOT, 'src', 'plugins', 'tui', 'dist', 'tui.tsx')
+  // Clean up the old broken relative ref (and stale dist refs) on upgrade.
+  unregisterPlugin(targetTuiConfigPath, 'plugins/pantheon-tui', { dryRun })
+  const tuiStatus = registerPlugin(targetTuiConfigPath, tuiPluginRef, { dryRun })
   if (tuiStatus === 'created') stats.created++
   else stats.skipped++
 
@@ -347,7 +340,17 @@ export async function installOpenCode(
       'pantheon_vision_server.py',
     ]
     const srcScriptsDir = join(ROOT, 'scripts')
+    // Canonical MCP server sources live in src/mcp/. Map them explicitly so the
+    // sync always copies from the canonical source, never from the stale root
+    // scripts/ copies (which previously propagated bugs like the missing
+    // `import uuid` in mcp_persistence_server.py). scrub-secrets.py is not in
+    // src/mcp/ and intentionally falls back to join(ROOT, 'scripts').
     const canonicalMcpScripts = {
+      'mcp_resources_server.py': join(ROOT, 'src', 'mcp', 'mcp_resources_server.py'),
+      'code_mode_server.py': join(ROOT, 'src', 'mcp', 'code_mode_server.py'),
+      'memory_mcp_server.py': join(ROOT, 'src', 'mcp', 'memory_mcp_server.py'),
+      '_pantheon_paths.py': join(ROOT, 'src', 'mcp', '_pantheon_paths.py'),
+      'mcp_persistence_server.py': join(ROOT, 'src', 'mcp', 'mcp_persistence_server.py'),
       'pantheon_vision_server.py': join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py'),
     }
     const dstScriptsDir = join(runtimeTarget, 'scripts')
@@ -565,15 +568,41 @@ export async function installOpenCode(
   if (!config.default_agent && pantheonConfig.default_agent) {
     config.default_agent = pantheonConfig.default_agent
   }
+  // Merge subagent_depth HERE (the config merge always runs, including on a
+  // fresh install) instead of a file-existence-gated block, so run #1 already
+  // produces the final config — run #2 must be a byte-identical no-op (#19).
+  if (config.subagent_depth === undefined) {
+    config.subagent_depth = 2
+  }
+
+  // --------------------------------------------------------------------
+  // B.5.1 Hermetic plugin resolution (packaging fix)
+  // --------------------------------------------------------------------
+  // The packaged opencode.json may reference the pantheon-hooks plugin via a
+  // developer-machine absolute path (e.g. /home/<dev>/pantheon/src/plugins/...).
+  // Copying that verbatim into the user's config would break every global
+  // install on any other machine. Option A: rewrite the entry to the plugin
+  // file inside the INSTALLED package (derived from ROOT — never hardcoded),
+  // so both dev and global installs resolve to a path that actually exists.
+  // The source opencode.json keeps its dev path for local development; the
+  // transform happens at install/sync time only.
+  function resolveInstalledPlugin(plugin) {
+    const file = basename(plugin)
+    const packaged = join(ROOT, 'src', 'plugins', file)
+    return existsSync(packaged) ? packaged : plugin
+  }
 
   if (!Array.isArray(config.plugin)) {
     config.plugin = []
   }
   if (Array.isArray(pantheonConfig.plugin)) {
     for (const plugin of pantheonConfig.plugin) {
-      if (!config.plugin.includes(plugin)) {
-        config.plugin.push(plugin)
-      }
+      const resolved = resolveInstalledPlugin(plugin)
+      const file = basename(resolved)
+      // Replace any pre-existing entry for the same plugin file (e.g. a stale
+      // dev-machine path from an earlier install) so upgrades stay hermetic.
+      config.plugin = config.plugin.filter((p) => basename(p) !== file)
+      config.plugin.push(resolved)
     }
   }
 

package/scripts/install/plugin.mjs

@@ -128,8 +128,10 @@ export function unregisterPlugin(tuiJsonPath, pluginId, { dryRun = false } = {})
   if (!Array.isArray(tuiConfig.plugin)) {
     tuiConfig.plugin = []
   }
-  // Remove stale plugin refs (old dist/tui.tsx path)
-  const staleRefs = [`${pluginId}/dist/tui.tsx`, `${pluginId}/dist/tui.js`]
+  // Remove stale refs: the bare relative id (openCode < 1.19 wrote
+  // "plugins/pantheon-tui", which its tui loader misreads as an npm/github
+  // spec → NpmInstallFailedError) and the old dist paths.
+  const staleRefs = [pluginId, `${pluginId}/dist/tui.tsx`, `${pluginId}/dist/tui.js`]
   for (const stale of staleRefs) {
     const idx = tuiConfig.plugin.indexOf(stale)
     if (idx !== -1) tuiConfig.plugin.splice(idx, 1)

package/scripts/install-mcp.mjs

@@ -23,13 +23,61 @@
 import { execSync } from 'node:child_process'
 import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { dirname, join, resolve } from 'node:path'
+import { basename, dirname, join, resolve } from 'node:path'
 import { createInterface } from 'node:readline'
 import { fileURLToPath } from 'node:url'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const ROOT = join(__dirname, '..')
 
+// ---------------------------------------------------------------------------
+// Hermetic path resolution (P2 — ENOENT-on-spawn elimination)
+//
+// Pantheon MCP commands MUST be generated with ABSOLUTE paths for both the
+// venv python3 and the server script. ROOT alone is ambiguous: when this
+// installer runs from a global npm install, `join(ROOT, '.venv/bin/python3')`
+// points at a venv that does not exist there, and a stale config with a
+// hardcoded path to a migrated home (e.g. /home/admin) fails with
+// `posix_spawn ENOENT`. Resolution order:
+//   1. Canonical user install: ~/.config/opencode/.venv + ~/.config/opencode/scripts/
+//   2. Local checkout:        <ROOT>/.venv + <ROOT>/<relPath>
+//   3. Fallback:              PATH python3 / ROOT path, with a warning
+// ---------------------------------------------------------------------------
+const CONFIG_OPENCODE = join(homedir(), '.config', 'opencode')
+
+function resolveVenvPython() {
+  const candidates = [
+    join(CONFIG_OPENCODE, '.venv', 'bin', 'python3'),
+    join(ROOT, '.venv', 'bin', 'python3'),
+  ]
+  for (const p of candidates) {
+    if (existsSync(p)) return p
+  }
+  console.warn(
+    `  ⚠️  Pantheon venv python3 not found (checked ${candidates.join(', ')}). Using PATH 'python3'.`,
+  )
+  return 'python3'
+}
+
+function resolveServerScript(relPath) {
+  const base = basename(relPath)
+  const candidates = [join(CONFIG_OPENCODE, 'scripts', base), join(ROOT, relPath)]
+  for (const p of candidates) {
+    if (existsSync(p)) return p
+  }
+  console.warn(
+    `  ⚠️  Pantheon MCP server script not found (checked ${candidates.join(', ')}). Using ${join(ROOT, relPath)}.`,
+  )
+  return join(ROOT, relPath)
+}
+
+const VENV_PYTHON = resolveVenvPython()
+const MCP_RESOURCES_SERVER = resolveServerScript('scripts/mcp_resources_server.py')
+const CODE_MODE_SERVER = resolveServerScript('scripts/code_mode_server.py')
+const MEMORY_MCP_SERVER = resolveServerScript('scripts/memory_mcp_server.py')
+const MCP_PERSISTENCE_SERVER = resolveServerScript('scripts/mcp_persistence_server.py')
+const PANTHEON_VISION_SERVER = resolveServerScript('src/mcp/pantheon_vision_server.py')
+
 // ---------------------------------------------------------------------------
 // MCP Definitions
 // ---------------------------------------------------------------------------
@@ -173,37 +221,37 @@ const MCPS = {
     platforms: {
       opencode: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_RESOURCES_SERVER],
       },
       vscode: {
         type: 'stdio',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_RESOURCES_SERVER],
       },
       cursor: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_RESOURCES_SERVER],
       },
       claude: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_RESOURCES_SERVER],
       },
       windsurf: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_resources_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_RESOURCES_SERVER],
       },
     },
     env: [],
     validate: async () => {
-      const scriptPath = join(ROOT, 'scripts', 'mcp_resources_server.py')
+      const scriptPath = MCP_RESOURCES_SERVER
       if (existsSync(scriptPath)) {
         return { ok: true, message: 'server script present' }
       }
-      return { ok: false, message: 'scripts/mcp_resources_server.py not found' }
+      return { ok: false, message: 'mcp_resources_server.py not found at resolved path' }
     },
   },
   'pantheon-code-mode': {
@@ -213,37 +261,37 @@ const MCPS = {
     platforms: {
       opencode: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/code_mode_server.py')],
+        command: VENV_PYTHON,
+        args: [CODE_MODE_SERVER],
       },
       vscode: {
         type: 'stdio',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/code_mode_server.py')],
+        command: VENV_PYTHON,
+        args: [CODE_MODE_SERVER],
       },
       cursor: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/code_mode_server.py')],
+        command: VENV_PYTHON,
+        args: [CODE_MODE_SERVER],
       },
       claude: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/code_mode_server.py')],
+        command: VENV_PYTHON,
+        args: [CODE_MODE_SERVER],
       },
       windsurf: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/code_mode_server.py')],
+        command: VENV_PYTHON,
+        args: [CODE_MODE_SERVER],
       },
     },
     env: [],
     validate: async () => {
-      const scriptPath = join(ROOT, 'scripts', 'code_mode_server.py')
+      const scriptPath = CODE_MODE_SERVER
       if (existsSync(scriptPath)) {
         return { ok: true, message: 'server script present' }
       }
-      return { ok: false, message: 'scripts/code_mode_server.py not found' }
+      return { ok: false, message: 'code_mode_server.py not found at resolved path' }
     },
   },
   'pantheon-memory': {
@@ -254,32 +302,32 @@ const MCPS = {
     platforms: {
       opencode: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/memory_mcp_server.py')],
+        command: VENV_PYTHON,
+        args: [MEMORY_MCP_SERVER],
       },
       claude: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/memory_mcp_server.py')],
+        command: VENV_PYTHON,
+        args: [MEMORY_MCP_SERVER],
       },
       cursor: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/memory_mcp_server.py')],
+        command: VENV_PYTHON,
+        args: [MEMORY_MCP_SERVER],
       },
       windsurf: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/memory_mcp_server.py')],
+        command: VENV_PYTHON,
+        args: [MEMORY_MCP_SERVER],
       },
     },
     env: [],
     validate: async () => {
-      const scriptPath = join(ROOT, 'scripts', 'memory_mcp_server.py')
+      const scriptPath = MEMORY_MCP_SERVER
       if (existsSync(scriptPath)) {
         return { ok: true, message: 'server script present' }
       }
-      return { ok: false, message: 'scripts/memory_mcp_server.py not found' }
+      return { ok: false, message: 'memory_mcp_server.py not found at resolved path' }
     },
   },
   'pantheon-persistence': {
@@ -290,32 +338,32 @@ const MCPS = {
     platforms: {
       opencode: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_persistence_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_PERSISTENCE_SERVER],
       },
       claude: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_persistence_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_PERSISTENCE_SERVER],
       },
       cursor: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_persistence_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_PERSISTENCE_SERVER],
       },
       windsurf: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'scripts/mcp_persistence_server.py')],
+        command: VENV_PYTHON,
+        args: [MCP_PERSISTENCE_SERVER],
       },
     },
     env: [],
     validate: async () => {
-      const scriptPath = join(ROOT, 'scripts', 'mcp_persistence_server.py')
+      const scriptPath = MCP_PERSISTENCE_SERVER
       if (existsSync(scriptPath)) {
         return { ok: true, message: 'server script present' }
       }
-      return { ok: false, message: 'scripts/mcp_persistence_server.py not found' }
+      return { ok: false, message: 'mcp_persistence_server.py not found at resolved path' }
     },
   },
   'pantheon-vision': {
@@ -327,33 +375,33 @@ const MCPS = {
     platforms: {
       opencode: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+        command: VENV_PYTHON,
+        args: [PANTHEON_VISION_SERVER],
       },
       vscode: {
         type: 'stdio',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+        command: VENV_PYTHON,
+        args: [PANTHEON_VISION_SERVER],
       },
       claude: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+        command: VENV_PYTHON,
+        args: [PANTHEON_VISION_SERVER],
       },
       cursor: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+        command: VENV_PYTHON,
+        args: [PANTHEON_VISION_SERVER],
       },
       windsurf: {
         type: 'local',
-        command: join(ROOT, '.venv/bin/python3'),
-        args: [join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')],
+        command: VENV_PYTHON,
+        args: [PANTHEON_VISION_SERVER],
       },
     },
     env: [],
     validate: async () => {
-      const sourcePath = join(ROOT, 'src', 'mcp', 'pantheon_vision_server.py')
+      const sourcePath = PANTHEON_VISION_SERVER
       const requirementsPath = join(ROOT, 'src', 'mcp', 'requirements-vision.txt')
       if (existsSync(sourcePath) && existsSync(requirementsPath)) {
         return { ok: true, message: 'canonical server source and isolated requirements present' }

package/scripts/mcp_persistence_server.py

@@ -14,6 +14,7 @@ import argparse
 import re
 import sqlite3
 import sys
+import uuid
 from datetime import datetime, timedelta, timezone
 from pathlib import Path